Where do I put my merchant keys?

In Cloudflare Pages → Project → Settings → Environment Variables. This demo reads them server-side via Pages Functions (so keys never reach the browser).

MERCHANT_KEY_ID=mk_test_xxx
MERCHANT_KEY_SECRET=sk_test_xxx
PAYMENT_API_BASE=https://api.krezno.xyz
WEBHOOK_SECRET=whsec_xxx   (optional, for webhook signature verification)